iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
8e6cf365e1d5c70e275a77a3c5ad7e3dc685474c
linux/kernel
History
Richard Guy Briggs 8e6cf365e1 audit: log nftables configuration change events 
iptables, ip6tables, arptables and ebtables table registration,
replacement and unregistration configuration events are logged for the
native (legacy) iptables setsockopt api, but not for the
nftables netlink api which is used by the nft-variant of iptables in
addition to nftables itself.

Add calls to log the configuration actions in the nftables netlink api.

This uses the same NETFILTER_CFG record format but overloads the table
field.

  type=NETFILTER_CFG msg=audit(2020-05-28 17:46:41.878:162) : table=?:0;?:0 family=unspecified entries=2 op=nft_register_gen pid=396 subj=system_u:system_r:firewalld_t:s0 comm=firewalld
  ...
  type=NETFILTER_CFG msg=audit(2020-05-28 17:46:41.878:162) : table=firewalld:1;?:0 family=inet entries=0 op=nft_register_table pid=396 subj=system_u:system_r:firewalld_t:s0 comm=firewalld
  ...
  type=NETFILTER_CFG msg=audit(2020-05-28 17:46:41.911:163) : table=firewalld:1;filter_FORWARD:85 family=inet entries=8 op=nft_register_chain pid=396 subj=system_u:system_r:firewalld_t:s0 comm=firewalld
  ...
  type=NETFILTER_CFG msg=audit(2020-05-28 17:46:41.911:163) : table=firewalld:1;filter_FORWARD:85 family=inet entries=101 op=nft_register_rule pid=396 subj=system_u:system_r:firewalld_t:s0 comm=firewalld
  ...
  type=NETFILTER_CFG msg=audit(2020-05-28 17:46:41.911:163) : table=firewalld:1;__set0:87 family=inet entries=87 op=nft_register_setelem pid=396 subj=system_u:system_r:firewalld_t:s0 comm=firewalld
  ...
  type=NETFILTER_CFG msg=audit(2020-05-28 17:46:41.911:163) : table=firewalld:1;__set0:87 family=inet entries=0 op=nft_register_set pid=396 subj=system_u:system_r:firewalld_t:s0 comm=firewalld

For further information please see issue
https://github.com/linux-audit/audit-kernel/issues/124

Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
2020-06-23 20:25:16 -04:00
..
bpf
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2020-06-13 16:27:13 -07:00
cgroup
mmap locking API: convert mmap_sem comments
2020-06-09 09:39:14 -07:00
configs
compiler: remove CONFIG_OPTIMIZE_INLINING entirely
2020-04-07 10:43:42 -07:00
debug
kernel: rename show_stack_loglvl() => show_stack()
2020-06-09 09:39:13 -07:00
dma
Merge tag 'dma-mapping-5.8' of git://git.infradead.org/users/hch/dma-mapping
2020-06-06 11:43:23 -07:00
events
Merge branch 'akpm' (patches from Andrew)
2020-06-09 09:54:46 -07:00
gcov
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
irq
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
kcsan
kcsan: Support distinguishing volatile accesses
2020-06-11 20:04:01 +02:00
livepatch
livepatch: Make klp_apply_object_relocs static
2020-05-11 00:31:38 +02:00
locking
Merge tag 'x86-entry-2020-06-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2020-06-13 10:05:47 -07:00
power
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
printk
Merge tag 'printk-for-5.8-kdb-nmi' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux
2020-06-12 12:13:36 -07:00
rcu
Merge tag 'tty-5.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty
2020-06-07 09:52:36 -07:00
sched
Rebase locking/kcsan to locking/urgent
2020-06-11 20:02:46 +02:00
time
Merge tag 'x86-entry-2020-06-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2020-06-13 10:05:47 -07:00
trace
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2020-06-13 16:27:13 -07:00
.gitignore
.gitignore: add SPDX License Identifier
2020-03-25 11:50:48 +01:00
acct.c
mmap locking API: convert mmap_sem comments
2020-06-09 09:39:14 -07:00
async.c
…
audit_fsnotify.c
fsnotify: use helpers to access data by data_type
2020-03-23 18:19:06 +01:00
audit_tree.c
audit: Use struct_size() helper in alloc_chunk
2020-06-17 16:43:11 -04:00
audit_watch.c
Merge tag 'fsnotify_for_v5.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs
2020-04-06 08:58:42 -07:00
audit.c
Merge tag 'audit-pr-20200601' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit
2020-06-02 17:13:37 -07:00
audit.h
audit: fix a net reference leak in audit_list_rules_send()
2020-04-22 15:23:10 -04:00
auditfilter.c
audit: fix a net reference leak in audit_list_rules_send()
2020-04-22 15:23:10 -04:00
auditsc.c
audit: log nftables configuration change events
2020-06-23 20:25:16 -04:00
backtracetest.c
…
bounds.c
…
capability.c
…
compat.c
uaccess: Selectively open read or write user access
2020-05-01 12:35:21 +10:00
configs.c
proc: convert everything to "struct proc_ops"
2020-02-04 03:05:26 +00:00
context_tracking.c
context_tracking: Ensure that the critical path cannot be instrumented
2020-06-11 15:14:36 +02:00
cpu_pm.c
kernel/cpu_pm: Fix uninitted local in cpu_pm
2020-05-15 11:44:34 -07:00
cpu.c
Merge tag 'sched-core-2020-06-02' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2020-06-03 13:06:42 -07:00
crash_core.c
…
crash_dump.c
crash_dump: Remove no longer used saved_max_pfn
2020-04-15 11:21:54 +02:00
cred.c
exec: Teach prepare_exec_creds how exec treats uids & gids
2020-05-20 14:44:21 -05:00
delayacct.c
…
dma.c
…
elfcore.c
kernel/elfcore.c: include proper prototypes
2019-09-25 17:51:39 -07:00
exec_domain.c
…
exit.c
mmap locking API: convert mmap_sem comments
2020-06-09 09:39:14 -07:00
extable.c
kernel/extable.c: use address-of operator on section symbols
2020-04-07 10:43:42 -07:00
fail_function.c
…
fork.c
mmap locking API: convert nested write lock sites
2020-06-09 09:39:14 -07:00
freezer.c
Revert "libata, freezer: avoid block device removal while system is frozen"
2019-10-06 09:11:37 -06:00
futex.c
mmap locking API: use coccinelle to convert mmap_sem rwsem call sites
2020-06-09 09:39:14 -07:00
gen_kheaders.sh
kbuild: add variables for compression tools
2020-06-06 23:42:01 +09:00
groups.c
mm: remove the pgprot argument to __vmalloc
2020-06-02 10:59:11 -07:00
hung_task.c
kernel/hung_task.c: introduce sysctl to print all traces when a hung task is detected
2020-06-08 11:05:56 -07:00
iomem.c
…
irq_work.c
irq_work, smp: Allow irq_work on call_single_queue
2020-05-28 10:54:15 +02:00
jump_label.c
jump_label: Don't warn on __exit jump entries
2019-08-29 15:10:10 +01:00
kallsyms.c
kallsyms: unexport kallsyms_lookup_name() and kallsyms_on_each_symbol()
2020-04-07 10:43:44 -07:00
kcmp.c
kernel/kcmp.c: Use new infrastructure to fix deadlocks in execve
2020-03-25 10:04:01 -05:00
Kconfig.freezer
…
Kconfig.hz
…
Kconfig.locks
sched/rt, locking: Use CONFIG_PREEMPTION
2019-12-08 14:37:36 +01:00
Kconfig.preempt
sched/Kconfig: Fix spelling mistake in user-visible help text
2019-11-12 11:35:32 +01:00
kcov.c
kcov: check kcov_softirq in kcov_remote_stop()
2020-06-10 19:14:17 -07:00
kexec_core.c
kexec: add machine_kexec_post_load()
2020-01-08 16:32:55 +00:00
kexec_elf.c
kexec_elf: support 32 bit ELF files
2019-09-06 23:58:44 +02:00
kexec_file.c
kexec_file: don't place kexec images on IORESOURCE_MEM_DRIVER_MANAGED
2020-06-04 19:06:23 -07:00
kexec_internal.h
kexec: add machine_kexec_post_load()
2020-01-08 16:32:55 +00:00
kexec.c
kexec: add machine_kexec_post_load()
2020-01-08 16:32:55 +00:00
kheaders.c
…
kmod.c
kmod: make request_module() return an error when autoloading is disabled
2020-04-10 15:36:22 -07:00
kprobes.c
kernel/kprobes.c: convert to use DEFINE_SEQ_ATTRIBUTE macro
2020-06-04 19:06:26 -07:00
ksysfs.c
…
kthread.c
Merge branch 'akpm' (patches from Andrew)
2020-06-11 13:25:53 -07:00
latencytop.c
sysctl: pass kernel pointers to ->proc_handler
2020-04-27 02:07:40 -04:00
Makefile
Merge tag 'notifications-20200601' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs
2020-06-13 09:56:21 -07:00
module_signature.c
MODSIGN: Export module signature definitions
2019-08-05 18:39:56 -04:00
module_signing.c
MODSIGN: Export module signature definitions
2019-08-05 18:39:56 -04:00
module-internal.h
…
module.c
module: move the set_fs hack for flush_icache_range to m68k
2020-06-08 11:05:58 -07:00
notifier.c
mm: remove vmalloc_sync_(un)mappings()
2020-06-02 10:59:12 -07:00
nsproxy.c
nsproxy: attach to namespaces via pidfds
2020-05-13 11:41:22 +02:00
padata.c
padata: add basic support for multithreaded jobs
2020-06-03 20:09:45 -07:00
panic.c
bug: Annotate WARN/BUG/stackfail as noinstr safe
2020-06-11 15:14:36 +02:00
params.c
lockdown: Lock down module params that specify hardware parameters (eg. ioport)
2019-08-19 21:54:16 -07:00
pid_namespace.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next
2020-06-03 16:27:18 -07:00
pid.c
remove the no longer needed pid_alive() check in __task_pid_nr_ns()
2020-04-30 06:40:14 -05:00
profile.c
proc: convert everything to "struct proc_ops"
2020-02-04 03:05:26 +00:00
ptrace.c
ptrace: reintroduce usage of subjective credentials in ptrace_has_cap()
2020-01-18 13:51:39 +01:00
range.c
…
reboot.c
printk: Collapse shutdown types into a single dump reason
2020-05-30 10:34:03 -07:00
relay.c
mmap locking API: convert mmap_sem comments
2020-06-09 09:39:14 -07:00
resource.c
/dev/mem: Revoke mappings when a driver claims the region
2020-05-27 11:10:05 +02:00
rseq.c
rseq: Reject unknown flags on rseq unregister
2019-12-25 10:41:20 +01:00
scs.c
scs: Report SCS usage in bytes rather than number of entries
2020-06-04 16:14:56 +01:00
seccomp.c
sysctl: pass kernel pointers to ->proc_handler
2020-04-27 02:07:40 -04:00
signal.c
Merge branch 'work.set_fs-exec' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2020-06-01 16:21:46 -07:00
smp.c
Merge tag 'sched-core-2020-06-02' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2020-06-03 13:06:42 -07:00
smpboot.c
…
smpboot.h
…
softirq.c
x86/entry: Clarify irq_{enter,exit}_rcu()
2020-06-11 15:15:24 +02:00
stackleak.c
…
stacktrace.c
stacktrace: Get rid of unneeded '!!' pattern
2019-11-11 10:30:59 +01:00
stop_machine.c
stop_machine: Make stop_cpus() static
2020-01-17 10:19:21 +01:00
sys_ni.c
y2038: allow disabling time32 system calls
2019-11-15 14:38:30 +01:00
sys.c
Merge tag 'LSM-add-setgid-hook-5.8-author-fix' of git://github.com/micah-morton/linux
2020-06-14 11:39:31 -07:00
sysctl_binary.c
sysctl: Remove the sysctl system call
2019-11-26 13:03:56 -06:00
sysctl-test.c
kunit: allow kunit tests to be loaded as a module
2020-01-09 16:42:29 -07:00
sysctl.c
kernel/sysctl.c: ignore out-of-range taint bits introduced via kernel.tainted
2020-06-08 11:05:56 -07:00
task_work.c
task_work_run: don't take ->pi_lock unconditionally
2020-03-02 14:06:33 -07:00
taskstats.c
taskstats: fix data-race
2019-12-04 15:18:39 +01:00
test_kprobes.c
…
torture.c
Merge tag 'smp-core-2020-03-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2020-03-30 18:06:39 -07:00
tracepoint.c
…
tsacct.c
tsacct: add 64-bit btime field
2019-12-18 18:07:31 +01:00
ucount.c
ucount: Make sure ucounts in /proc/sys/user don't regress again
2020-04-07 21:51:27 +02:00
uid16.c
…
uid16.h
…
umh.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2020-05-15 13:48:59 -07:00
up.c
smp/up: Make smp_call_function_single() match SMP semantics
2020-02-07 15:34:12 +01:00
user_namespace.c
nsproxy: add struct nsset
2020-05-09 13:57:12 +02:00
user-return-notifier.c
…
user.c
user.c: make uidhash_table static
2020-06-04 19:06:24 -07:00
utsname_sysctl.c
sysctl: pass kernel pointers to ->proc_handler
2020-04-27 02:07:40 -04:00
utsname.c
nsproxy: add struct nsset
2020-05-09 13:57:12 +02:00
watch_queue.c
Merge tag 'notifications-20200601' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs
2020-06-13 09:56:21 -07:00
watchdog_hld.c
…
watchdog.c
kernel/watchdog.c: convert {soft/hard}lockup boot parameters to sysctl aliases
2020-06-08 11:05:56 -07:00
workqueue_internal.h
…
workqueue.c
workqueue: use BUILD_BUG_ON() for compile time test instead of WARN_ON()
2020-06-01 11:02:42 -04:00